d899e6c5976e4319fa165596c67bffb20b227d5cff685f4f52e521bbcf747943

Analysis

max time kernel
136s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

281beb73bf797c0ada2b1daf68739405.html
Size

35KB
MD5

281beb73bf797c0ada2b1daf68739405
SHA1

ffee41a8ebd2d14d9e07400ee9963cd00186a03f
SHA256

d899e6c5976e4319fa165596c67bffb20b227d5cff685f4f52e521bbcf747943
SHA512

a19ac36221929214e9851656ebdc66272e8d56b13490301a163804ee1529f6a4efecb66124e4bd7ff5cb3251502676b350bc17934f06232fb779d746e134c825
SSDEEP

768:zwx/MDTHOQ88hARzZPXeE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOX6sggh6lLRX:Q/bbJxNVvu0Sx/P88K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607b6422d73fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F6BA211-ABCA-11EE-BC40-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410621447"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006cac1ed513be315a4c498e54415a828d015da36be35ba220d0d312b1637ed3fa000000000e80000000020000200000005f5fc8b42e47c0977fe06b2c2424667897d4aeb460a4b93a5d4525726100063f900000006ae7029bf5f23679ab328033c61936582e3195b15f986579cafb6e06ff891de53e735d09ac94a614d0271f2efc8fc1e424e7601de2d966311e9a2bc311a62fe76366a28145217a905ad7730116fa1a1fda818513e59276152617ef16028694f63837a3c9e6ca5cba314c65ff4d15ff2197aa9af340ba92ab6190769747979031713389a931c0fa4368c625a48025d04640000000d0fa02ccc48ed8697a505aa12282c20aa701eb5509d7e43268f23bc7450ca6e80d4b749b44e09024eedfee9aea929a2c032760d67b8e60f3e5895ae951d40eb0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000013ebf6c480cf7bcc8d307b87bc6da8b0c2f224b0ace8efaa4c216b22b9f9c5e4000000000e80000000020000200000008a0b3a21283f9d12dbe4d34136ad8b887116ec1494338fb0bb70623e1a9a0beb200000004c3a1251223ec9ce21866a108f09e949c224e5544f9af26563c4fddb720c5781400000000c334c767ba2ed48cd016c16ba5671c64e7698d4a235c5c66d60d1568d976a41085a86b17a24b94a0eeb9a33e0291a621ce3df30976adde074c4f2d1f0bfbbdb	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1472	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1472	iexplore.exe
1472	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2060	1472	iexplore.exe	28
PID 1472 wrote to memory of 2060	1472	iexplore.exe	28
PID 1472 wrote to memory of 2060	1472	iexplore.exe	28
PID 1472 wrote to memory of 2060	1472	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\281beb73bf797c0ada2b1daf68739405.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1472 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42478aa49610adf2e288817a472804f0

SHA1
ce599ecfe2ed4a7946c4a049cb76804a7da9a9a4

SHA256
beda227d806fe89738b3ba372076dda78b584350cd143a56534dce7a26838a65

SHA512
e3b0b0097e12de9f64b78254021f178c2b2eeeeca3920b6de2424fcce47997df28712fb6c7c572eb4a0db0993506bb64aa2e982c77105a958107802016bdbc1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b651625979b763b03649d13f98da3c10

SHA1
28dd683a0113153ce553cc9d9d1cdccf966c47fe

SHA256
12ea53808dc3c11e1b4f6352b191a3ea346306c6059e6c4e81fed7603168639b

SHA512
10f2e0be06eec30f3271c358f7c775449c6f52ba08226c2740a8b5ff118729c76961d7548e2d78f1e17317be9eca9bc5d5df8af1975a1cc91f8e60f5563ee49c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d841d0770433ac6767f76c3a68433dd

SHA1
998a4fd7094c00b4f687c1f2eb058b42b7b6bad2

SHA256
cea837da1ef1f82e7b187e8a54bb49024dbfebd28218c3dbfad22a379b97ac84

SHA512
48a85da5cbf0df65b89a520b77aa65256aea269cbc95fb0ae5b247251661accf4d1d3dbd520a600630e2b3938f7b6de1a4e8dffcfd95b9f663147833337feb07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12f30911dd5fef3ab8e106ce903b6bab

SHA1
40337b750ce754515606e4a0bdad84bfbf58157b

SHA256
64635ced91c8cf2659e429892ad15ee605ca6268396e97851d9769d11f6df4b3

SHA512
c1c72a0e1fa863a955e9244e97070df1b495249e14ffcd49ade62f07012e2e7b42a9af967449ddf15cafc8f0f2081c5ae57f2d883dffba227d0a6bbf8f6c3293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ab804ffbf16f7931c503b35c3534ad3

SHA1
2289bc10eb9584c647c01a2a521b840e56b8ea0f

SHA256
e7837218191047393cfd55c00ef925beb936bb61c83980aad4fbaadcfd575693

SHA512
9efda0eb23dcc341f1facb3eb60dc262f6f4829d89035e42d5fa98e69f9fc7a0d466533e5189f4d77babff686012e2760cba6dc85615cab076567fb6757320ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae527e001cce507635818614af2fbbae

SHA1
7b85288d295b84ecc83f6cb8a82b4c60283d149f

SHA256
d0fd6845043cf300cd223f1be9b2955910b060306cd1a6c12b1c321fad903bc6

SHA512
6c40077c2645c8aaf890f5e975cc613c61a88c8b1cd95475e02abd3c770683ab778c4c6eec7839f7b015fe794c960fe8b6a7c4912a583da24b1cad1b3c0ce03a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c6a8f8f0b0e7ca009935469a47d26c2

SHA1
a2872dd5d4e2c13ae418d4b34221df134af170d1

SHA256
f59ad80d9509ffeb2a80bbaead724f8dbfbed3e169d5678576da1f788d99bf7a

SHA512
c02267c5324b8c691019301fbf173c80014758bfe1bdfca38990d985c93dbf40d7a5a1a4b4cc8e59f4a1b0a19386f01c993ac9fea77038ba33a82fcbe5bb852a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d989d05e5e8372c8a9a2c3a84bb1aa8

SHA1
faf21117d487ff0df7cfdf60d95edcd092e8dc6a

SHA256
652dfe6b21fb1548f5603027b8a817f0ad23d7337bcd81f5dc290b960c1554d7

SHA512
e72f6bd39ee79f858ae764e3eb760dd98a93fe5e55fbcab30ef5e2f986610a34ea51a58526b281e8db5f40667fb0e80e9deb0bc2d0747c1c666f0d562d16efd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e3a3f4c5d8afff41513e6c87490564b

SHA1
8449ed7a07f05a1892f16a5b11822a520898f7eb

SHA256
eb07bffbc40ce11486b9942d8c7888af2c99c6638b52c68f5b4aba235f6a96d8

SHA512
541d8a009b7b48b1f549cbcd20f3ebc33440069593056bb204e3bc268c933396b945548ea04562a42f1d50db5248f0ae15ac397d0dcfd65063e25b5245b41fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\ae111d25cbb9b2d7293e8bdb2fcfe8b3[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\default_large[1].png

Filesize
2KB

MD5
2334473e35e3553c2814a72d53dc2811

SHA1
f25cbe3e713cbb4b8c4abdf39ef5db01725f8678

SHA256
7cac1c32518340d6ce8101c2e5a73bbac9d40cb451eb063daf0af2a946172b48

SHA512
3c8d24dba84f64f12bab695fdecc26f1a80716190f42258e05d90b3fa04b74e696a5ecb780ad6e12b809f410b94299ebfa177f02c347fe5af0650545a62a5694

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB76D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB772.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit